4.9-stable patches

added patches:
	staging-ion-prevent-incorrect-reference-counting-behavour.patch

diff --git a/queue-4.9/series b/queue-4.9/series
new file mode 100644 (file)
index 0000000..7b79d4f
--- /dev/null
+++ b/queue-4.9/series
@@ -0,0 +1 @@
+staging-ion-prevent-incorrect-reference-counting-behavour.patch

diff --git a/queue-4.9/staging-ion-prevent-incorrect-reference-counting-behavour.patch b/queue-4.9/staging-ion-prevent-incorrect-reference-counting-behavour.patch
new file mode 100644 (file)
index 0000000..011ecb3
--- /dev/null
+++ b/queue-4.9/staging-ion-prevent-incorrect-reference-counting-behavour.patch
@@ -0,0 +1,43 @@
+From lee.jones@linaro.org  Sat Nov 27 12:56:17 2021
+From: Lee Jones <lee.jones@linaro.org>
+Date: Fri, 26 Nov 2021 10:33:35 +0000
+Subject: staging: ion: Prevent incorrect reference counting behavour
+To: lee.jones@linaro.org
+Cc: devel@driverdev.osuosl.org, arve@android.com, stable@vger.kernel.org, riandrews@android.com, labbott@redhat.com, sumit.semwal@linaro.org, Dan Carpenter <dan.carpenter@oracle.com>
+Message-ID: <20211126103335.880816-1-lee.jones@linaro.org>
+
+From: Lee Jones <lee.jones@linaro.org>
+
+Supply additional checks in order to prevent unexpected results.
+
+Fixes: b892bf75b2034 ("ion: Switch ion to use dma-buf")
+Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/ion/ion.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -489,6 +489,9 @@ static void *ion_buffer_kmap_get(struct
+       void *vaddr;
+ 
+       if (buffer->kmap_cnt) {
++              if (buffer->kmap_cnt == INT_MAX)
++                      return ERR_PTR(-EOVERFLOW);
++
+               buffer->kmap_cnt++;
+               return buffer->vaddr;
+       }
+@@ -509,6 +512,9 @@ static void *ion_handle_kmap_get(struct
+       void *vaddr;
+ 
+       if (handle->kmap_cnt) {
++              if (handle->kmap_cnt == INT_MAX)
++                      return ERR_PTR(-EOVERFLOW);
++
+               handle->kmap_cnt++;
+               return buffer->vaddr;
+       }